General
- Target 2026-05-31_bb7c166dc95c0d5e22c03e40a6a12ce2_coinminer_darkgate_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry
- Size 2.0MB
- Sample260531-12khfahs31
- SHA256 027d132b09f803b78a20f1b0c39ea9b11ddfc8e868d859d836aa3980f20437e4
- MD5 bb7c166dc95c0d5e22c03e40a6a12ce2
- SHA1 44e7ea7d25f20f627ea56200c19c89349487a05f
- SHA512 f0ed56210f9fd40cce07d4ca6969ed7f6354754685013a02718930144110269ca5e485a91679eb76eb136b2eeb6861f8239de4b278279553778b644bdf935436
- SSDEEP 49152:M3bcgSlbTChxKCnFnQXBbrtgb/iQvu0UHOaW:6Gl6hxvWbrtUTrUHO7
- TLSH T172A5EF117791CC62F76FC13247E25F78B17368202B32CD876B8429396BF1D9ADBA1216
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-31_bb7c166dc95c0d5e22c03e40a6a12ce2_coinminer_darkgate_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-31_bb7c166dc95c0d5e22c03e40a6a12ce2_coinminer_darkgate_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win11-20260513-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-31_bb7c166dc95c0d5e22c03e40a6a12ce2_coinminer_darkgate_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry
- Size 2.0MB
- SHA256 027d132b09f803b78a20f1b0c39ea9b11ddfc8e868d859d836aa3980f20437e4
- MD5 bb7c166dc95c0d5e22c03e40a6a12ce2
- SHA1 44e7ea7d25f20f627ea56200c19c89349487a05f
- SHA512 f0ed56210f9fd40cce07d4ca6969ed7f6354754685013a02718930144110269ca5e485a91679eb76eb136b2eeb6861f8239de4b278279553778b644bdf935436
- SSDEEP 49152:M3bcgSlbTChxKCnFnQXBbrtgb/iQvu0UHOaW:6Gl6hxvWbrtUTrUHO7
- TLSH T172A5EF117791CC62F76FC13247E25F78B17368202B32CD876B8429396BF1D9ADBA1216
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Drops file in System32 directory